South Korea fines SK Telecom $97M over data breach

South Korea’s biggest mobile carrier has been hit with a record fine after a massive data breach exposed the personal details of nearly half the country’s people.

The Personal Information Protection Commission (PIPC) said on Thursday it fined SK Telecom 134.8 billion won (about US$97 million) for weak security and for failing to report breaches quickly. The regulator also ordered the company to strengthen its safeguards, criticising it for years of lapses that left customer data exposed. This is the largest penalty the PIPC has handed down since it was formed in 2020.

The case stems from a breach disclosed in April, when SK Telecom revealed that hackers had stolen universal subscriber identity module (USIM) data. The company offered free replacements to affected users, but regulators launched a deeper probe into the data leak.

According to the PIPC, hackers obtained 25 types of data tied to 23.2 million customers on LTE and 5G plans. The compromised information included phone numbers and international mobile subscriber identities. Investigators said attackers first infiltrated the company’s internal systems in August 2021 and again in June 2022, planting malware that later enabled the theft of 9.82 GB of user data on April 18, 2025.

The regulator concluded that the security breach was made possible by basic failures. In one instance, SK Telecom did not investigate after discovering hackers had reached its home subscriber server in February 2022. The server, which stored sensitive personal data, could be accessed without authentication checks, according to the PIPC.

“The company had been in a vulnerable state for quite a long time, with significant weaknesses in the board,” PIPC Chairman Ko Haksoo said. “There were opportunities to identify and address these issues over time, but the company missed those chances and continued to overlook them for a long period. The left the company in a pretty weak and exposed position. The committee members felt a sense of frustration about this.”

The fallout from the data breach has been building. In July, the Ministry of Science and ICT said SK Telecom should allow customers to cancel contracts without penalty. Now, with the regulator’s fine and harsh assessment, pressure is growing for the carrier to overhaul its data protection practices.

SK Telecom expressed regret over the decision. “We regret that our position and actions, which were fully explained during the investigation and deliberation, were not reflected in the outcome,” the company said.

While much of the public debate has focused on ransomware or financial losses tied to stolen data, some officials see wider risks. Lawmaker Yu Yong Weon, who proposed a National Cybersecurity Act in July, warned that the data breach could also threaten national security. He said call data records could allow attackers to reconstruct call logs, exposing sensitive conversations at the highest levels of government. His proposed law would set up a unified system for emergency response and intelligence-sharing to counter cyber threats.

Concerns extend beyond South Korea. Bloomberg reported that hackers linked to China, known as Salt Typhoon, breached telecom operators including AT&T, raising alarms in the US about surveillance of senior officials and possible risks to FBI informants.

The SK Telecom data breach underscores how telecom networks are tied to both consumer safety and national security. For regulators in South Korea, the record fine sends a message: failure to protect personal data is no longer just a business issue but a broader threat with far-reaching consequences.

(Photo by Towfiqu barbhuiya)

See also: Global DDoS attacks exceed 8M amid geopolitical tensions

Want to discover how IoT is transforming telecoms and connectivity? Join the IoT Tech Expo in Amsterdam, California, and London. Explore how innovations in 5G, edge computing, and IoT are shaping the future of networks and services. The event is part of TechEx and co-located with other leading technology conferences, click here for more information.

Telecoms News is powered by TechForge Media. Explore other upcoming enterprise technology events and webinars here.

Tags: cyberattack, cybersecurity, hacking, network, networks